diff --git a/.github/TESTING_AUTOMATION.md b/.github/TESTING_AUTOMATION.md
index 3232618..5169d78 100644
--- a/.github/TESTING_AUTOMATION.md
+++ b/.github/TESTING_AUTOMATION.md
@@ -19,7 +19,7 @@ Issue #48 is a perfect test case for the Ansible dependency updates:
 
 ### Method 1: Manually Trigger via GitHub Actions UI
 
-1. Go to the [Actions tab](https://github.com/Stensel8/Scripts/actions)
+1. Go to the [Actions tab](https://github.com/Thectic-NL/Scripts/actions)
 2. Select "Auto-Update Dependencies" workflow
 3. Click "Run workflow"
 4. Enter issue number: `48`
@@ -29,7 +29,7 @@ Issue #48 is a perfect test case for the Ansible dependency updates:
 
 The workflow automatically runs when dependency issues are opened or edited:
 
-1. Go to [Issue #48](https://github.com/Stensel8/Scripts/issues/48)
+1. Go to [Issue #48](https://github.com/Thectic-NL/Scripts/issues/48)
 2. Click "Edit" on the issue
 3. Add a space or make any minor edit to the description
 4. Save the changes
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..ce2e241
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,12 @@
+self-hosted-runner: {}
+
+paths:
+  .github/workflows/validate-scripts.yml:
+    ignore:
+      # validate-scripts.yml already runs `shellcheck -S warning` itself
+      # (see the "Run ShellCheck" step) as a deliberate choice to treat
+      # info/style findings as non-blocking. actionlint's own shellcheck
+      # integration doesn't pick up a repo .shellcheckrc, so without this
+      # it re-litigates that choice at error level for the same scripts.
+      - 'SC2086:info:'
+      - 'SC2129:style:'
diff --git a/.github/scripts/check-renovate-patterns.py b/.github/scripts/check-renovate-patterns.py
new file mode 100644
index 0000000..bb7c695
--- /dev/null
+++ b/.github/scripts/check-renovate-patterns.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+# Copyright (C) 2026 Sten Tijhuis
+# SPDX-License-Identifier: MIT
+"""Flag Renovate file patterns that look like a regex but are not delimited.
+
+managerFilePatterns and matchFileNames accept "RegEx (re2) and glob patterns".
+A value counts as a regex only when it is wrapped in slashes; everything else
+is read as a glob. So a pattern like
+
+    "^\\.github/workflows/.*\\.ya?ml$"
+
+matches no file at all, and the custom manager around it never fires. Nothing
+reports this: renovate-config-validator says the config is valid, because it
+is -- it just silently does nothing. The only visible symptom is a dependency
+that stops receiving updates, which is easy to miss for months.
+
+Usage: check-renovate-patterns.py [config.json ...]
+Missing files are skipped, so the same call works in every repository.
+"""
+import json
+import pathlib
+import re
+import sys
+
+# Constructs that carry meaning in a regex but not in a glob.
+REGEXY = re.compile(r"^\^|\$$|\\\.|\.\*|\.\+|\(\?|\[\^|\\d|\\w|\\s|[)?]\|")
+
+# Renovate options whose values are matched as "regex or glob".
+PATTERN_KEYS = {
+    "managerFilePatterns",
+    "matchFileNames",
+    "fileMatch",
+    "matchPackageNames",
+}
+
+problems = []
+
+
+def walk(node, path, source):
+    if isinstance(node, dict):
+        for key, value in node.items():
+            if key in PATTERN_KEYS and isinstance(value, list):
+                for index, pattern in enumerate(value):
+                    if not isinstance(pattern, str):
+                        continue
+                    # A trailing "i" flag is allowed: /pattern/i
+                    delimited = pattern.startswith("/") and pattern.rstrip("i").endswith("/")
+                    if REGEXY.search(pattern) and not delimited:
+                        problems.append((source, f"{path}.{key}[{index}]", pattern))
+            walk(value, f"{path}.{key}", source)
+    elif isinstance(node, list):
+        for index, item in enumerate(node):
+            walk(item, f"{path}[{index}]", source)
+
+
+files = [path for path in (pathlib.Path(a) for a in sys.argv[1:]) if path.is_file()]
+if not files:
+    print("No Renovate config found to check.")
+    sys.exit(0)
+
+for config in files:
+    walk(json.loads(config.read_text()), "$", str(config))
+
+if problems:
+    print("Renovate file patterns that look like a regex but are not wrapped in slashes.")
+    print("Renovate reads these as globs, so they match nothing and the rule never fires.\n")
+    for source, where, pattern in problems:
+        print(f"::error file={source}::{where}: {pattern!r} is read as a glob, not a regex")
+        print(f"  {source}  {where}")
+        print(f"    found:  {pattern!r}")
+        print(f"    expect: '/{pattern}/'\n")
+    sys.exit(1)
+
+print(f"Checked {len(files)} Renovate config file(s): all file patterns are well formed.")
diff --git a/.github/workflows/config-validation.yml b/.github/workflows/config-validation.yml
new file mode 100644
index 0000000..ceb8310
--- /dev/null
+++ b/.github/workflows/config-validation.yml
@@ -0,0 +1,88 @@
+# Copyright (C) 2026 Sten Tijhuis
+# SPDX-License-Identifier: MIT
+name: Config validation
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'renovate.json'
+      - '.github/renovate.json'
+      - '.github/dependabot.yml'
+      - '.github/dependabot.yaml'
+      - '.github/scripts/check-renovate-patterns.py'
+      - '.github/workflows/**'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'renovate.json'
+      - '.github/renovate.json'
+      - '.github/dependabot.yml'
+      - '.github/dependabot.yaml'
+      - '.github/scripts/check-renovate-patterns.py'
+      - '.github/workflows/**'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  bot-configs:
+    name: Renovate and Dependabot config
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 'lts/*'
+
+      - name: Validate Renovate config
+        env:
+          NPM_CONFIG_LOGLEVEL: error
+        run: npx --yes --package renovate -- renovate-config-validator --strict
+
+      - name: Check Renovate file patterns
+        run: python3 .github/scripts/check-renovate-patterns.py renovate.json .github/renovate.json
+
+      - name: Validate Dependabot config
+        env:
+          # renovate: datasource=pypi depName=check-jsonschema
+          CHECK_JSONSCHEMA_VERSION: "0.38.0"
+        run: |
+          config=""
+          for candidate in .github/dependabot.yml .github/dependabot.yaml; do
+            if [ -f "$candidate" ]; then
+              config="$candidate"
+              break
+            fi
+          done
+          if [ -z "$config" ]; then
+            echo "No dependabot.yml in this repository; nothing to validate."
+            exit 0
+          fi
+          pipx install "check-jsonschema==${CHECK_JSONSCHEMA_VERSION}"
+          check-jsonschema --builtin-schema vendor.dependabot "$config"
+
+      - name: Install actionlint
+        if: ${{ !cancelled() }}
+        env:
+          # renovate: datasource=github-releases depName=rhysd/actionlint
+          ACTIONLINT_VERSION: "1.7.12"
+          ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
+        run: |
+          curl -sSL --fail-with-body -o actionlint.tar.gz \
+            --retry 5 --retry-delay 3 --retry-all-errors \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  actionlint.tar.gz" | sha256sum -c -
+          tar -xzf actionlint.tar.gz actionlint
+          sudo install -m 0755 actionlint /usr/local/bin/actionlint
+
+      - name: Run actionlint
+        if: ${{ !cancelled() }}
+        run: actionlint -color
diff --git a/.github/workflows/deploy-bunny.yml b/.github/workflows/deploy-bunny.yml
new file mode 100644
index 0000000..21b822f
--- /dev/null
+++ b/.github/workflows/deploy-bunny.yml
@@ -0,0 +1,84 @@
+# Copyright (C) 2026 Sten Tijhuis
+# SPDX-License-Identifier: MIT
+name: Deploy to Bunny.net
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - 'src/**'
+      - '.github/workflows/deploy-bunny.yml'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: "deploy"
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    name: Build and deploy to Bunny Storage
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      HUGO_VERSION: 0.165.0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: src/go.mod
+
+      - name: Install Hugo
+        run: |
+          wget -O "${{ runner.temp }}/hugo.deb" \
+            "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb" \
+          && sudo dpkg -i "${{ runner.temp }}/hugo.deb"
+
+      - name: Build with Hugo
+        env:
+          HUGO_CACHEDIR: ${{ runner.temp }}/hugo_cache
+          HUGO_ENVIRONMENT: production
+          TZ: Europe/Amsterdam
+        run: |
+          cd src && hugo \
+            --gc \
+            --minify \
+            --baseURL "https://scripts.thectic.nl/"
+
+      - name: Upload to Bunny Storage
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.BUNNY_STORAGE_ZONE }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.BUNNY_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: de
+          STORAGE_ZONE: ${{ secrets.BUNNY_STORAGE_ZONE }}
+          STORAGE_ENDPOINT: ${{ secrets.BUNNY_STORAGE_ENDPOINT }}
+        run: |
+          aws s3 sync src/public/ "s3://${STORAGE_ZONE}/" \
+            --endpoint-url "${STORAGE_ENDPOINT}" \
+            --delete \
+            --no-progress
+
+      - name: Wait for storage replication
+        run: sleep 15
+
+      - name: Purge Bunny Pull Zone cache
+        env:
+          PULL_ZONE_ID: ${{ secrets.BUNNY_PULL_ZONE_ID }}
+          API_KEY: ${{ secrets.BUNNY_API_KEY }}
+        run: |
+          curl -sS --fail-with-body -X POST \
+            "https://api.bunny.net/pullzone/${PULL_ZONE_ID}/purgeCache" \
+            -H "AccessKey: ${API_KEY}" \
+            -H "Content-Type: application/json"
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
new file mode 100644
index 0000000..034be92
--- /dev/null
+++ b/.github/workflows/pr-title.yml
@@ -0,0 +1,34 @@
+# Copyright (C) 2026 Sten Tijhuis
+# SPDX-License-Identifier: MIT
+name: PR title
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+concurrency:
+  group: pr-title-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  pr-title:
+    name: Conventional commit title
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            content
+            docs
+            chore
+            refactor
+            style
+            revert
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
new file mode 100644
index 0000000..6422c97
--- /dev/null
+++ b/.github/workflows/trivy-scan.yml
@@ -0,0 +1,32 @@
+name: "Trivy filesystem scan"
+
+on:
+  schedule:
+    - cron: '0 2 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          severity: CRITICAL,HIGH
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: Upload Trivy results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif
diff --git a/.gitignore b/.gitignore
index 5eec986..8642b54 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
 .claude
+src/public/
+src/resources/
+src/.hugo_build.lock
diff --git a/README.md b/README.md
index 00bc861..6f6b7f5 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,13 @@
 # Scripts
 
-Installer scripts for tools and software I use regularly. Tailored to my preferences, but easy to adapt.
+Installer scripts for tools and software used regularly. Tailored to THectic's preferences, but easy to adapt.
+
+Also browsable as a site: [scripts.thectic.nl](https://scripts.thectic.nl) (`src/`).
 
 ## Usage
 
 ```bash
-git clone --recurse-submodules https://github.com/Stensel8/scripts.git
+git clone --recurse-submodules https://github.com/Thectic-NL/Scripts.git
 cd scripts
 ```
 
diff --git a/src/content/_index.md b/src/content/_index.md
new file mode 100644
index 0000000..8740e2d
--- /dev/null
+++ b/src/content/_index.md
@@ -0,0 +1,87 @@
+---
+title: ""
+toc: false
+---
+
+<div class="hx-mt-6 hx-mb-6">
+{{< hextra/hero-headline >}}
+  Scripts
+{{< /hextra/hero-headline >}}
+</div>
+
+<div class="hx-mb-12">
+{{< hextra/hero-subtitle >}}
+  Installer scripts for tools THectic uses regularly — Bash and PowerShell, easy to adapt
+{{< /hextra/hero-subtitle >}}
+</div>
+
+<div class="hx-mb-10" style="margin-top: 2.5rem !important;">
+{{< hextra/hero-badge link="https://github.com/Thectic-NL/Scripts" >}}
+  <span>View on GitHub</span>
+  {{< icon name="github" attributes="height=20" >}}
+{{< /hextra/hero-badge >}}
+</div>
+
+<div class="hx-mt-6"></div>
+
+## Usage
+
+```bash
+git clone --recurse-submodules https://github.com/Thectic-NL/Scripts.git
+cd Scripts
+```
+
+Bash:
+```bash
+./<tool>_installer.sh
+```
+
+PowerShell:
+```powershell
+pwsh ./<tool>_installer.ps1
+```
+
+## Scripts
+
+| Directory | File(s) | Platform | Notes |
+|-----------|---------|----------|-------|
+| `ansible/` | `ansible_installer.sh` | Linux | Installs Ansible via pip in a venv |
+| `docker/` | `docker_installer.sh` | Linux | Official Docker repositories |
+| `kubernetes/` | `kubernetes_installer.sh` | Linux | kubectl + optional Minikube |
+| `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
+| `openssh/` | `openssh_installer.sh` | Linux | Hardened config, Ed25519-only, post-quantum KEX (ML-KEM) |
+| `podman/` | `podman_installer.sh` | Linux | Distribution repositories |
+| `system/` | `planned_shutdown.sh` | Linux | Schedule/cancel/check a planned shutdown or reboot |
+| `terraform/` | `terraform_installer.sh` | Linux | HashiCorp repositories |
+| `TLS-tools/` | `TLS-checker.ps1` | Cross-platform | Tests TLS versions, HTTP versions, QUIC, HSTS, compression |
+| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Comprehensive TLS/SSL scanner by Dirk Wetter — pinned at a specific version |
+| `windows/` | `Enable-WinRM.ps1` | Windows | Configures WinRM for remote management |
+| `windows/` | `Get-InstalledSoftware.ps1` | Windows | Lists installed software from registry |
+| `windows/` | `Optimize-WindowsVM.ps1` | Windows | Disables unnecessary services for VMs |
+| `windows/` | `Install-VagrantVMware.ps1` | Windows | Installs Vagrant + VMware Workstation |
+| `windows/` | `Install-DellCommandUpdate.ps1` | Windows | Installs Dell Command Update via winget |
+| `windows/` | `Install-HPImageAssistant.ps1` | Windows | Installs HP Image Assistant via winget |
+| `windows/` | `Set-PlannedShutdown.ps1` | Windows | Schedule/cancel/check a planned shutdown or reboot |
+
+## Linux distro support
+
+All Linux installers target the same three package-manager families:
+
+| Script | apt (Debian/Ubuntu) | dnf (Fedora/RHEL) | pacman (Arch) |
+|--------|:---:|:---:|:---:|
+| `ansible_installer.sh` | ✅ | ✅ | ✅ |
+| `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
+| `kubernetes_installer.sh` | ✅ | ✅ | ✅ ² |
+| `nginx_installer.sh` | ✅ | ✅ | ✅ |
+| `openssh_installer.sh` | ✅ | ✅ | ✅ |
+| `podman_installer.sh` | ✅ | ✅ | ✅ |
+| `terraform_installer.sh` | ✅ | ✅ | ✅ ¹ |
+
+¹ No vendor repo exists for Arch; installed from the community repos.
+² No pkgs.k8s.io repo exists for Arch; kubectl is installed as a checksum-verified binary.
+
+openSUSE (zypper) is not supported.
+
+{{< callout type="info" >}}
+Dependency checks run weekly; script validation (ShellCheck for Bash, PSScriptAnalyzer for PowerShell) runs on every push. See the [GitHub repository](https://github.com/Thectic-NL/Scripts) for the full source and conventions.
+{{< /callout >}}
diff --git a/src/content/_index.nl.md b/src/content/_index.nl.md
new file mode 100644
index 0000000..b3fc2a0
--- /dev/null
+++ b/src/content/_index.nl.md
@@ -0,0 +1,87 @@
+---
+title: ""
+toc: false
+---
+
+<div class="hx-mt-6 hx-mb-6">
+{{< hextra/hero-headline >}}
+  Scripts
+{{< /hextra/hero-headline >}}
+</div>
+
+<div class="hx-mb-12">
+{{< hextra/hero-subtitle >}}
+  Installatiescripts voor tools die THectic regelmatig gebruikt — Bash en PowerShell, makkelijk aan te passen
+{{< /hextra/hero-subtitle >}}
+</div>
+
+<div class="hx-mb-10" style="margin-top: 2.5rem !important;">
+{{< hextra/hero-badge link="https://github.com/Thectic-NL/Scripts" >}}
+  <span>Bekijk op GitHub</span>
+  {{< icon name="github" attributes="height=20" >}}
+{{< /hextra/hero-badge >}}
+</div>
+
+<div class="hx-mt-6"></div>
+
+## Gebruik
+
+```bash
+git clone --recurse-submodules https://github.com/Thectic-NL/Scripts.git
+cd Scripts
+```
+
+Bash:
+```bash
+./<tool>_installer.sh
+```
+
+PowerShell:
+```powershell
+pwsh ./<tool>_installer.ps1
+```
+
+## Scripts
+
+| Map | Bestand(en) | Platform | Toelichting |
+|-----------|---------|----------|-------|
+| `ansible/` | `ansible_installer.sh` | Linux | Installeert Ansible via pip in een venv |
+| `docker/` | `docker_installer.sh` | Linux | Officiële Docker-repositories |
+| `kubernetes/` | `kubernetes_installer.sh` | Linux | kubectl + optioneel Minikube |
+| `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
+| `openssh/` | `openssh_installer.sh` | Linux | Hardened config, alleen Ed25519, post-quantum KEX (ML-KEM) |
+| `podman/` | `podman_installer.sh` | Linux | Distributie-repositories |
+| `system/` | `planned_shutdown.sh` | Linux | Geplande afsluiting/herstart plannen/annuleren/controleren |
+| `terraform/` | `terraform_installer.sh` | Linux | HashiCorp-repositories |
+| `TLS-tools/` | `TLS-checker.ps1` | Cross-platform | Test TLS-versies, HTTP-versies, QUIC, HSTS, compressie |
+| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Uitgebreide TLS/SSL-scanner van Dirk Wetter — vastgezet op een specifieke versie |
+| `windows/` | `Enable-WinRM.ps1` | Windows | Configureert WinRM voor remote beheer |
+| `windows/` | `Get-InstalledSoftware.ps1` | Windows | Toont geïnstalleerde software uit het register |
+| `windows/` | `Optimize-WindowsVM.ps1` | Windows | Schakelt onnodige services uit voor VM's |
+| `windows/` | `Install-VagrantVMware.ps1` | Windows | Installeert Vagrant + VMware Workstation |
+| `windows/` | `Install-DellCommandUpdate.ps1` | Windows | Installeert Dell Command Update via winget |
+| `windows/` | `Install-HPImageAssistant.ps1` | Windows | Installeert HP Image Assistant via winget |
+| `windows/` | `Set-PlannedShutdown.ps1` | Windows | Geplande afsluiting/herstart plannen/annuleren/controleren |
+
+## Ondersteunde Linux-distro's
+
+Alle Linux-installers richten zich op dezelfde drie pakketbeheerfamilies:
+
+| Script | apt (Debian/Ubuntu) | dnf (Fedora/RHEL) | pacman (Arch) |
+|--------|:---:|:---:|:---:|
+| `ansible_installer.sh` | ✅ | ✅ | ✅ |
+| `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
+| `kubernetes_installer.sh` | ✅ | ✅ | ✅ ² |
+| `nginx_installer.sh` | ✅ | ✅ | ✅ |
+| `openssh_installer.sh` | ✅ | ✅ | ✅ |
+| `podman_installer.sh` | ✅ | ✅ | ✅ |
+| `terraform_installer.sh` | ✅ | ✅ | ✅ ¹ |
+
+¹ Geen vendor-repo voor Arch; installatie via de community-repositories.
+² Geen pkgs.k8s.io-repo voor Arch; kubectl wordt geïnstalleerd als checksum-geverifieerde binary.
+
+openSUSE (zypper) wordt niet ondersteund.
+
+{{< callout type="info" >}}
+Dependency-checks draaien wekelijks; scriptvalidatie (ShellCheck voor Bash, PSScriptAnalyzer voor PowerShell) draait bij elke push. Zie de [GitHub-repository](https://github.com/Thectic-NL/Scripts) voor de volledige broncode en conventies.
+{{< /callout >}}
diff --git a/src/go.mod b/src/go.mod
new file mode 100644
index 0000000..18b08aa
--- /dev/null
+++ b/src/go.mod
@@ -0,0 +1,5 @@
+module github.com/Thectic-NL/Scripts
+
+go 1.26
+
+require github.com/imfing/hextra v0.12.3 // indirect
diff --git a/src/go.sum b/src/go.sum
new file mode 100644
index 0000000..afa8680
--- /dev/null
+++ b/src/go.sum
@@ -0,0 +1,2 @@
+github.com/imfing/hextra v0.12.3 h1:DZHY2rUWYteyzjlHi9r4n7Bb5e2Q+6LXe4C1Dqn0ZjM=
+github.com/imfing/hextra v0.12.3/go.mod h1:vi+yhpq8YPp/aghvJlNKVnJKcPJ/VyAEcfC1BSV9ARo=
diff --git a/src/hugo.toml b/src/hugo.toml
new file mode 100644
index 0000000..912c025
--- /dev/null
+++ b/src/hugo.toml
@@ -0,0 +1,73 @@
+baseURL = 'https://scripts.thectic.nl/'
+title = 'Scripts'
+defaultContentLanguage = 'en'
+enableRobotsTXT = true
+disableKinds = ['taxonomy', 'term', 'RSS']
+disableHugoGeneratorInject = true
+
+[languages]
+  [languages.en]
+    label = 'English'
+    weight = 1
+    title = 'Scripts'
+    locale = 'en-US'
+  [languages.nl]
+    label = 'Nederlands'
+    weight = 2
+    title = 'Scripts'
+    locale = 'nl-NL'
+
+[menu]
+  [[menu.main]]
+    name = 'GitHub'
+    weight = 1
+    url = 'https://github.com/Thectic-NL/Scripts'
+    [menu.main.params]
+      icon = 'github'
+  [[menu.main]]
+    name = 'Language'
+    weight = 2
+    [menu.main.params]
+      type = 'language-switch'
+  [[menu.main]]
+    name = 'Theme'
+    weight = 3
+    [menu.main.params]
+      type = 'theme-toggle'
+
+[params]
+  description = 'Installer scripts for tools THectic uses regularly — Bash and PowerShell, easy to adapt'
+  copyright = 'THectic'
+
+  [params.navbar]
+    displayTitle = true
+    displayLogo = false
+    width = 'wide'
+
+  [params.theme]
+    default = 'system'
+    displayToggle = false
+
+  [params.footer]
+    enable = true
+    displayCopyright = false
+    displayPoweredBy = false
+    width = 'normal'
+
+  displayUpdatedDate = true
+  dateFormat = 'January 2, 2006'
+
+  [params.editURL]
+    enable = false
+
+  [params.page]
+    width = 'wide'
+
+[markup]
+  [markup.goldmark]
+    [markup.goldmark.renderer]
+      unsafe = true
+
+[module]
+  [[module.imports]]
+    path = "github.com/imfing/hextra"
diff --git a/src/static/robots.txt b/src/static/robots.txt
new file mode 100644
index 0000000..c2a49f4
--- /dev/null
+++ b/src/static/robots.txt
@@ -0,0 +1,2 @@
+User-agent: *
+Allow: /